Ransomware recovery firms almost always just pay the hackers
Assessment
ProPublica's May 15, 2019 investigation 'The Trade Secret' reported that firms including MonsterCloud marketed proprietary recovery while almost always just paying the ransom, sometimes without telling clients; researcher Fabian Wosar's sting traced ransom-payment offers back to MonsterCloud. Pinhasi disputed the account and called his methods a trade secret. The EDNY indictment returned September 23, 2026 now alleges exactly this conduct for MonsterCloud and quotes Pinhasi's own May 2019 admission that the company held no proprietary decryption technology. The 2019 finding, contested at the time, is corroborated by the charging document — though the charges remain allegations pending trial and Pinhasi is presumed innocent.
Where this claim appeared
ProPublica · 2019-05-15
https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackersWhat “Verified” means
Established by primary sources — the original disclosure, a vendor incident report, a court filing, a government advisory, or the affected party itself. Where a claim is material, at least two independent sources agree.
5 of 5 · rating scale
Assessed in
MonsterCloud ransomware-recovery fraud: owner Zohar Pinhasi charged in EDNY with secretly paying the hackersThink this assessment is wrong? Report an error.